@wenathlan/devthink 2.0.15 → 2.0.20

package/tests/secretvault.test.ts

@@ -1,188 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  inmemoryvault,
-  secretleakscan,
-  secretshapecarrying,
-  vaultcovers,
-  vaultdelete,
-  vaultdigestof,
-  vaultentryof,
-  vaultprompttext,
-  vaultstore,
-  vaultvaluefor,
-  vaultview,
-} from "../security.js";
-
-const now = 1_800_000_000_000;
-
-describe("secretvault", () => {
-  it("stores secrets behind the vault seam while only metadata persists", async () => {
-    const seam = inmemoryvault();
-    const entry = await vaultstore({
-      seam,
-      label: "Bank login",
-      scope: "https://bank.example",
-      profileid: "profile",
-      provenance: "user",
-      value: "hunter2",
-      now,
-    });
-    expect(entry.label).toBe("Bank login");
-    expect(entry.scope).toBe("https://bank.example");
-    expect(entry.algorithm).toBe("sha-256");
-    expect(entry.digest.startsWith("sha256:")).toBe(true);
-    expect(JSON.stringify(entry)).not.toContain("hunter2");
-    const value = await vaultvaluefor({ seam, entry });
-    expect(value.ok).toBe(true);
-    expect(value.value).toBe("hunter2");
-    expect(value.reason).toMatch(/last possible moment/);
-  });
-
-  it("derives the sha-256 verification digest of a value so no plaintext persists", async () => {
-    const digest = await vaultdigestof("token-value");
-    expect(digest.startsWith("sha256:")).toBe(true);
-    expect(digest.length).toBe("sha256:".length + 64);
-    expect(await vaultdigestof("token-value")).toBe(digest);
-    expect(await vaultdigestof("other")).not.toBe(digest);
-  });
-
-  it("refuses vault records without a label, a scope or a digest", () => {
-    expect(() =>
-      vaultentryof({
-        label: "  ",
-        scope: "https://bank.example",
-        profileid: "p",
-        provenance: "user",
-        digest: "sha256:abc",
-        now,
-      }),
-    ).toThrow(/label/);
-    expect(() =>
-      vaultentryof({ label: "Bank", scope: "", profileid: "p", provenance: "user", digest: "sha256:abc", now }),
-    ).toThrow(/scope/);
-    expect(() =>
-      vaultentryof({
-        label: "Bank",
-        scope: "https://bank.example",
-        profileid: "p",
-        provenance: "user",
-        digest: "raw",
-        now,
-      }),
-    ).toThrow(/digest/);
-  });
-
-  it("drops a secret from the seam so no value and no copy remains", async () => {
-    const seam = inmemoryvault();
-    const entry = await vaultstore({
-      seam,
-      label: "Api key",
-      scope: "https://api.example",
-      profileid: "p",
-      provenance: "session",
-      value: "secret-value",
-      now,
-    });
-    const dropped = await vaultdelete({ seam, entry });
-    expect(dropped.dropped).toBe(true);
-    expect(dropped.reason).toMatch(/no value and no copy remains/);
-    const missing = await vaultvaluefor({ seam, entry });
-    expect(missing.ok).toBe(false);
-    expect(missing.reason).toMatch(/holds no value/);
-  });
-
-  it("scopes every vault record to exactly one origin", () => {
-    const entry = {
-      vaultid: "v",
-      label: "Bank",
-      scope: "https://bank.example",
-      profileid: "p",
-      provenance: "user" as const,
-      algorithm: "sha-256" as const,
-      digest: "sha256:abc",
-      createdat: now,
-    };
-    expect(vaultcovers(entry, "https://bank.example")).toBe(true);
-    expect(vaultcovers(entry, "https://lookalike.bank.example")).toBe(false);
-    expect(vaultcovers(entry, "https://other.example")).toBe(false);
-  });
-
-  it("refuses secrets that leaked into step options, variables and plan texts", async () => {
-    const seam = inmemoryvault();
-    const entry = await vaultstore({
-      seam,
-      label: "Bank login",
-      scope: "https://bank.example",
-      profileid: "p",
-      provenance: "user",
-      value: "hunter2",
-      now,
-    });
-    const leaked = await secretleakscan({ candidates: ["plain text", "hunter2", ""], entries: [entry] });
-    expect(leaked.leaks).toEqual(["hunter2"]);
-    expect(leaked.reason).toMatch(/never ride step options/);
-    const clean = await secretleakscan({ candidates: ["plain text"], entries: [entry] });
-    expect(clean.leaks).toEqual([]);
-    expect(clean.reason).toMatch(/no leaked secret/);
-  });
-
-  it("refuses raw typed values behind masked field shapes in step options", () => {
-    const carrying = secretshapecarrying({
-      kind: "fillform",
-      target: "#login",
-      options: JSON.stringify({ fields: [{ name: "password", value: "hunter2" }] }),
-    });
-    expect(carrying.carries).toBe(true);
-    expect(carrying.reason).toMatch(/vault at the last possible moment/);
-    const clean = secretshapecarrying({
-      kind: "fillform",
-      target: "#login",
-      options: JSON.stringify({ fields: [{ name: "username", value: "anna" }] }),
-    });
-    expect(clean.carries).toBe(false);
-    const rawoption = secretshapecarrying({ kind: "type", target: "#card", value: "4242" });
-    expect(rawoption.carries).toBe(false);
-  });
-
-  it("serves the vault view with labels and scopes only", () => {
-    const entry = {
-      vaultid: "v",
-      label: "Bank login",
-      scope: "https://bank.example",
-      profileid: "p",
-      provenance: "user" as const,
-      algorithm: "sha-256" as const,
-      digest: "sha256:abc",
-      createdat: now,
-      lastusedat: now + 5,
-    };
-    const view = vaultview([entry]);
-    expect(view).toEqual([
-      {
-        vaultid: "v",
-        label: "Bank login",
-        scope: "https://bank.example",
-        provenance: "user",
-        createdat: now,
-        lastusedat: now + 5,
-      },
-    ]);
-    expect(JSON.stringify(view)).not.toContain("sha256:abc");
-  });
-
-  it("prompts with the credential label only and never the value", () => {
-    const entry = {
-      vaultid: "v",
-      label: "Bank login",
-      scope: "https://bank.example",
-      profileid: "p",
-      provenance: "user" as const,
-      algorithm: "sha-256" as const,
-      digest: "sha256:abc",
-      createdat: now,
-    };
-    const prompt = vaultprompttext(entry, "https://bank.example");
-    expect(prompt).toContain("Bank login");
-    expect(prompt).toMatch(/value stays behind the vault/);
-  });
-});

package/tests/selcache.test.ts

@@ -1,111 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  advanceselcachegeneration,
-  cacheselentry,
-  invalidateselcacheonmutations,
-  invalidateselcacheonnavigation,
-  openselcache,
-  revalidateselentry,
-  selcacheentries,
-  selcachelookup,
-  selcachestats,
-  stalegenerationfailure,
-} from "../memory.js";
-import { selcachegate } from "../policy.js";
-import { sessionmemory } from "../memory.js";
-
-const now = 1_800_000_000_000;
-
-class fakeadapter {
-  private readonly data = new Map<string, unknown>();
-  async get<T>(key: string): Promise<T | undefined> {
-    return this.data.get(key) as T | undefined;
-  }
-  async set<T>(key: string, value: T): Promise<void> {
-    this.data.set(key, value);
-  }
-}
-
-describe("selcache hit, invalidation and revalidation", () => {
-  it("caches one resolution per selector under the current generation", () => {
-    let cache = openselcache("run1");
-    cache = cacheselentry(cache, { selector: "#a", resolution: "resolved:#a" });
-    cache = cacheselentry(cache, { selector: "#a", resolution: "resolved:#a:second" });
-    expect(cache.entries).toHaveLength(1);
-    expect(cache.entries[0]?.resolution).toBe("resolved:#a:second");
-    expect(() => openselcache(" ")).toThrow(/run id/i);
-    expect(() => cacheselentry(cache, { selector: " ", resolution: "x" })).toThrow(/selector/i);
-  });
-
-  it("advances the generation on every dom mutation batch so old hits go stale", () => {
-    let cache = cacheselentry(openselcache("run1"), { selector: "#a", resolution: "resolved:#a" });
-    const lookup = selcachelookup(cache, "#a");
-    expect(lookup.hit).toBe(true);
-    expect(lookup.stale).toBe(false);
-    cache = advanceselcachegeneration(cache, now);
-    const stale = selcachelookup(cache, "#a");
-    expect(stale.hit).toBe(false);
-    expect(stale.stale).toBe(true);
-    expect(stale.reason).toMatch(/generation 0 while the run stands at generation 1/i);
-    expect(selcachegate({ selector: "#a", resolution: "resolved:#a", generation: 0 }, 1).allowed).toBe(false);
-    expect(selcachegate({ selector: "#a", resolution: "resolved:#a", generation: 1 }, 1).allowed).toBe(true);
-  });
-
-  it("invalidates wholesale on navigation and selectively on matching mutation fingerprints", () => {
-    let cache = openselcache("run1");
-    cache = cacheselentry(cache, { selector: "#header .logo", resolution: "r1" });
-    cache = cacheselentry(cache, { selector: "#table .row", resolution: "r2" });
-    const navigated = invalidateselcacheonnavigation(cache, now);
-    expect(navigated.entries).toHaveLength(0);
-    expect(navigated.invalidations[0]?.reason).toBe("navigation");
-    expect(navigated.invalidations[0]?.selectors).toEqual(["#header .logo", "#table .row"]);
-    const mutated = invalidateselcacheonmutations(cache, ["#header"], now);
-    expect(mutated.entries.map((entry) => entry.selector)).toEqual(["#table .row"]);
-    expect(mutated.invalidations[0]?.reason).toBe("mutation");
-    expect(mutated.invalidations[0]?.selectors).toEqual(["#header .logo"]);
-  });
-
-  it("revalidates cached hits before the dispatch and overwrites diverging resolutions", () => {
-    let cache = cacheselentry(openselcache("run1"), { selector: "#a", resolution: "resolved:#a" });
-    const confirmed = revalidateselentry(cache, { selector: "#a", freshresolution: "resolved:#a" });
-    expect(confirmed).toBe(cache);
-    const diverged = revalidateselentry(cache, { selector: "#a", freshresolution: "resolved:#a:fresh" });
-    expect(diverged.entries[0]?.resolution).toBe("resolved:#a:fresh");
-    expect(diverged.entries[0]?.generation).toBe(cache.generation);
-    const added = revalidateselentry(cache, { selector: "#b", freshresolution: "resolved:#b" });
-    expect(added.entries.map((entry) => entry.selector)).toEqual(["#a", "#b"]);
-    const stats = selcachestats(cache, [
-      { hit: true, stale: false },
-      { hit: false, stale: true },
-      { hit: true, stale: false },
-    ]);
-    expect(stats).toEqual({ hits: 2, stale: 1, total: 3 });
-    expect(
-      selcacheentries(advanceselcachegeneration(cacheselentry(cache, { selector: "#a", resolution: "r" }), now)),
-    ).toHaveLength(0);
-  });
-
-  it("reports stale generation failures with a reviewed retry hint and prunes at run end", async () => {
-    const failure = stalegenerationfailure({
-      stepid: "s1",
-      runid: "run1",
-      selector: "#a",
-      entrygeneration: 0,
-      currentgeneration: 3,
-      now,
-    });
-    expect(failure.message).toMatch(/generation 0 while the run run1 stands at generation 3/i);
-    expect(failure.retry.allowed).toBe(true);
-    expect(failure.retry.reason).toMatch(/new reviewed dispatch/i);
-    expect(failure.context).toEqual({ selector: "#a", entrygeneration: "0", currentgeneration: "3" });
-    const store = new sessionmemory(new fakeadapter());
-    let state = cacheselentry(openselcache("run1"), { selector: "#a", resolution: "r" });
-    state = advanceselcachegeneration(state, now);
-    await store.setselcachestate(state);
-    expect((await store.getselcachestate("run1"))?.generation).toBe(1);
-    await store.pruneselcache("run1");
-    const pruned = await store.getselcachestate("run1");
-    expect(pruned?.entries).toHaveLength(0);
-    expect(pruned?.generation).toBe(0);
-  });
-});